Privacy Policy

Draft updated September 7, 2026

This notice describes the Brawl of Ages test website, game services, and administration tools intended for arenabrawler.com. It describes this project, not the historical Brawl of Ages service or unrelated websites.

1. Who handles your information

Kongor Studios, LLC operates Brawl of Ages and is responsible for the information described here. Our address is 10511 W H Ave, Kalamazoo, MI 49009, United States. For privacy questions or requests, contact info@kongorstudios.com or write to us at that address.

2. Information the service processes

  • Account information: account ID, login, display name, status, permissions, and a protected password hash if password sign-in is used. The service does not store your password in readable form.
  • Game information: owned cards, decks, virtual resource balances and adjustments, match loadouts, and gameplay or match records generated by available features.
  • Security and administration records: session identifiers, login attempts, account changes, staff actions, and reasons recorded for changes.
  • Technical information: launch time, selected game mode and quality, browser user-agent, and diagnostic information. Hosting and network services may also process IP addresses, request details, and security logs.
  • Information you choose to provide when asking for support. Do not send passwords or unnecessary sensitive information.

3. Google sign-in

Google sign-in lets invited players create an account and lets existing players and authorized staff sign in. Account creation requires an invitation PIN. We receive your verified email address and Google’s unique account identifier to create or identify your account. The PIN is checked on our server and is not stored in your account or sent to Google. An operator-designated, verified Google identity may receive the initial administrator role. We do not request access to Gmail, Google Drive, contacts, or calendars, and never receive your Google password.

Google authentication tokens are processed during sign-in but are not retained in our account database. We retain the linked identifier, email, and linking/login timestamps. Google data is used for authentication, account security, and support, not advertising. Google handles its own processing under its Privacy Policy.

4. Why information is used

We use information to provide accounts and matches, save decks and progress, manage access, investigate errors and abuse, answer support requests, and maintain accountable administration. Where applicable law requires a legal basis, these activities may rely on providing the requested service, legitimate interests in operating and securing it, or legal obligations. Consent is requested where legally required; choosing Google sign-in does not authorize unrelated uses of Google data.

5. Cookies and browser storage

The application uses necessary session cookies to keep you signed in and a short-lived cookie to protect Google sign-in. Staff sessions expire after four hours, signed-in player sessions after twelve hours, and the Google sign-in flow after ten minutes. Guest sessions last 90 days and renew when you return to or actively use the site. The guest cookie identifies this browser, not your physical device. Clearing cookies or switching browsers can make unlinked guest progress inaccessible. Creating a new Google account from a guest session preserves that player; signing into an existing account switches players. Expiration ends validity; it does not necessarily immediately remove the corresponding database record. Browser storage may retain interface preferences. Blocking cookies can prevent sign-in. This notice does not authorize advertising or optional tracking cookies.

Guest play starts with optional device diagnostics disabled. You can change them in Settings or the lobby account panel. The Google sign-in form shows a preselected optional diagnostics checkbox. You can uncheck it before continuing; submitting the form saves the displayed choice. You can also change it later in Settings. When enabled, we collect available hardware information (logical processors, approximate RAM, CPU architecture, device model, GPU vendor/renderer, display and graphics capabilities), browser and reported OS versions, and page/game performance, loading-stage timings and connection measurements. Reports are associated with your player and browser session. During matches, periodic FPS, frame-stall, snapshot-delivery and game-gateway round-trip measurements are linked to the match timestamp, hardware and game release. Replay downloads for match participants can include each consenting player’s performance timeline, without hardware identifiers or fingerprints; downloaded copies remain on the device where you save them. These match diagnostics expire from our database after 30 days and are removed when you disable diagnostics. We derive a first-party hardware fingerprint from a fixed subset of these reported hardware properties using a server-side keyed hash. It helps compare reports for technical support and product decisions; it is not a unique physical-device identifier and is never used to sign you in, restore deleted cookies, or merge accounts. We do not collect canvas images, raw error messages or browsing history through this feature. Earlier basic-diagnostics permission does not enable the expanded hardware/fingerprinting collection; the updated choice must be saved. Turning diagnostics off deletes the reports and fingerprint for that browser session. Guest recovery works with diagnostics disabled.

First-party product analytics record visits, page categories, referring website domains, daily game-client activity and bot/online match participation to measure usage and return rates. A random analytics cookie distinguishes browsers and expires 180 days after its last renewal. Player activity uses the existing authenticated player ID; it does not use hardware fingerprints. Analytics also record the reported IP address, browser user agent, language and authenticated player association for each visit, available only to staff for traffic analysis. IP addresses may identify a shared network or VPN. Analytics do not store URL query strings, match tickets or full referring URLs. Browser and visit history is retained for historical usage reporting; account-linked daily activity follows the account-data deletion schedule below. Aggregate concurrency samples contain counts rather than player identities. Optional hardware and performance diagnostics remain governed by the separate choice above.

6. Access and sharing

When practice coaching is enabled, the service summarizes match outcomes, mana usage, and observed card use to recommend a next step. AI-assisted coaching sends a compact gameplay summary and eligible tips to OpenAI. It does not send your account ID, display name, email, sign-in credentials, chat, or a full match replay. The service requests no stored API response; provider processing policies still apply. Coaching recommendations and your choice to try or dismiss them are saved with your player’s match records.

Authorized staff can access information needed for their responsibilities. Infrastructure providers, including DigitalOcean for hosting and Cloudflare for domain/network services where configured, process information needed to provide those services. Google processes Google sign-in. Information may also be disclosed when legally required or necessary to investigate abuse and protect users or the service. Account display names and gameplay information may be visible to other match participants.

The current application does not include a sale of personal information or an advertising-data sharing feature. Providers may process information outside your country. Hosting locations and any legally required international transfer safeguards must be confirmed before broader launch.

7. Retention and deletion

Our retention schedule is below. This schedule has been selected for the service but operational cleanup and backup expiry are still being configured during testing. These are the intended limits for public operation, not a claim that automated deletion is already active.

  • Account details, linked Google identity, cards, decks, and balances: while your account remains open. After a verified deletion request or permanent account closure, delete or irreversibly anonymize these records within 30 days. Suspension alone does not close an account.
  • Optional device reports and hardware fingerprints: 30 days, with hourly cleanup. Browser session records for this feature expire after 90 days without activity ; signing out removes the credential association but keeps previously consented reports for their remaining retention period. These limits do not delete saved player progress.
  • Routine technical logs, launch diagnostics, and raw match diagnostics: up to 30 days after creation. Saved progress and match results associated with an open account follow the account-data schedule.
  • Security records, administrative audit history, and virtual-resource adjustment ledgers: up to 12 months after the event, with unnecessary identifying details removed when an account is deleted.
  • Support correspondence: up to 12 months after the request is resolved.
  • Expired session, login-throttling, and temporary Google sign-in records: remove within 24 hours after they expire or are no longer needed for the active security window. Google authentication tokens are not retained.
  • Backups: expire within 35 days of creation. Deleted data may remain in restricted backups until they expire; if a backup is restored, deletion requests must be reapplied before normal service resumes.

We may preserve specific records longer where necessary for a legal obligation, an active security investigation, or an unresolved dispute. Such exceptions are limited to relevant records, restricted in access, and reviewed every 90 days; records are removed when the reason ends. Truly anonymous aggregate statistics may be kept without an account-linked retention limit.

You may request account deletion or removal of a Google link by emailing info@kongorstudios.com. Removing Brawl of Ages access in your Google account does not itself delete your Brawl of Ages account or existing application sessions. Ask us to revoke those sessions if needed.

8. Your choices and rights

Depending on your location, you may have rights to access, correct, delete, or obtain a copy of your information; restrict or object to certain processing; withdraw consent where it is used; and complain to your local data protection authority. Email info@kongorstudios.com to make a request. We may need to verify account ownership. Some records may be retained where permitted or required by law.

9. Security and children

The application uses measures such as password hashing, restricted staff access, and protected session cookies. No system is completely secure. This test service is not directed at children under 13. If you believe a child under 13 has provided personal information, notify info@kongorstudios.com so it can be investigated and appropriately removed.

10. Changes

We will update this page when practices change and provide additional notice or request consent when required. The date above identifies this draft’s latest revision.